Circular CSSF 20/750 is a CSSF circular, published 25 August 2020. Subject: Requirements regarding information and communication technology (ICT) and security risk management.
\nLegal basis: Law of 5 April 1993 on the financial sector, Law of 15 December 2000 on postal services and postal financial services.
\nRelevant for: AISPs, Credit institutions, Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Payment institutions, Payment institutions/electronic money institutions/AISPs, Specialised PFS, Support PFS.
\nKeywords: Cloud, Cybersecurity, eDesk, Information and communications technology (ICT), Information security, Operational risk, Payment Service Provider (PSP), Payment services, Postal financial services, Risk management.
\nAmended by Circular CSSF 22/828, Circular CSSF 25/881, Circular CSSF 26/915. Repeals Circular CSSF 19/713.
\non requirements regarding information and communication technology (ICT) and security risk management
\non requirements regarding information and technology (ICT) and security risk management
\ncommunication
\nTo support PFS and specialised PFS within the meaning of the Law of 5 April 1993 on the financial sector (LFS), and POST Luxembourg governed by the Law of 15 December 2000 on postal financial services 1.
\nLuxembourg, 25 August 2020
\nLadies and Gentlemen,
\nThis circular reflects the expectations of the CSSF as regards the risk management measures and control and security arrangements as referred to in Articles 17(1a) and 36(1) of the Law of 5 April 1993 on the financial sector (“LFS”) and in Article 105-1 (1) of the Law of 10 November 2009 on payment services (“LPS”). This circular is divided in four Chapters: •
\nChapter 1 indicates the scope of this circular
\nChapter 2 provides definitions and clarifications with regards to the terms used in this circular
\nChapter 3 lists the requirements regarding ICT and security risk management
\nChapter 4 indicates the entry into force of this circular
\n1 For the sake of clarity, the wording “postal financial services” has the meaning provided for in Article 1 of the Law of 15 December 2000 as amended.
\nCIRCULAR CSSF 20/750 as amended by Circulars CSSF 22/828, CSSF 25/881 and CSSF 26/915
\nTABLE OF CONTENTS Chapter 1.
\nEntities in Scope ........................................................................................... 4
\nChapter 2.
\nDefinitions.................................................................................................... 4
\nChapter 3.
\nGuidelines on ICT and security risk management .............................................. 5
\n3.1.
\nProportionality .......................................................................................... 5
\n3.2.
\nGovernance and strategy ........................................................................... 6
\n3.3.
\nICT and security risk management framework .............................................. 7
\n3.4.
\nInformation security.................................................................................. 9
\n3.5.
\nICT operations management .................................................................... 13
\n3.6.
\nICT project and change management ........................................................ 15
\n3.7.
\nBusiness continuity management .............................................................. 17
\nChapter 4.
\nDate of application ...................................................................................... 19
\nCIRCULAR CSSF 20/750 as amended by Circulars CSSF 22/828, CSSF 25/881 and CSSF 26/915
\nChapter 1. Entities in Scope This circular is applicable in full to all the following entities: a) All support PFS within the meaning of the Law of 5 April 1993 on the financial sector (LFS) b) All specialised PSF within the meaning of the Law of 5 April 1993 on the financial sector (LFS) c)
\nPOST Luxembourg governed by the Law of 15 December 2000 on postal financial services 2 and as Payment Service Provider as referred to in Article 1(37)(iii) of the LPS
\nChapter 2. Definitions Financial Institution
\nThroughout this document this term refers to the supervised entities in scope of this circular as defined in Chapter 1.
\nPayment Service Provider (PSP)
\nThroughout this document this term refers to POST Luxembourg.
\nICT and security risk
\nRisk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or unavailability of systems and data or inability to change information technology (IT) within a reasonable time and with reasonable costs when the environment or business requirements change (i.e. agility).
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}